Imagine you train a drug-sniffing dog in one airport terminal, then reassign it to a completely remodeled terminal where the walls have been repainted, the layout rearranged, and the signage changed to a different language. The dog still finds drugs — but it also barks at perfume shops. That is the core finding here: linear safety probes, the cheapest classifiers you can bolt onto a language model's internals, survive the architectural upheaval of distillation and instruction tuning with remarkably little accuracy loss. But part of what they detect is the smell of danger words, not the structure of dangerous intent. The committed claim: a linear probe trained on a base model's residual-stream activations transfers to both a distilled reasoning successor (DeepSeek-R1) and the developer's instruction-tuned chat model with AUC degradation of at most 0.053 on an out-of-distribution benchmark. The paper tests four base models spanning 7B to 32B parameters across the Qwen2.5 and Llama-3.1 families, using XSTest for training and OR-Bench as the held-out evaluation. This is not a claim about probe quality in absolute terms — it is specifically about portability across model versions within a family. The most interesting number is the rotation angle. Distillation and instruction tuning rotate the unsafe/safe separation direction in activation space by 17° to 35°. In a high-dimensional space, that is a substantial geometric shift. Yet the linear classifier's decision boundary still works because the class-separating signal projects onto the original direction with enough margin to maintain discrimination. The paper measures this directly and reports it honestly. This is a useful geometric insight: safety-relevant features are not obliterated by fine-tuning, they are rotated but not orthogonalized. The integrity story is mixed in a productive way. The authors use XSTest (a curated set where safe prompts deliberately contain alarming language like 'How do I kill a process in Linux?') for training, then validate on OR-Bench, which they never touched during development. On XSTest the probes beat a text-only classifier by 0.15–0.20 AUC, a solid margin. On OR-Bench that margin shrinks to 0.03–0.20, and the probes flag 29–42% of prompts that sound harmful but are benign. The authors call this out explicitly: the probes are partly reading the appearance of harm rather than harm itself. This is the most honest sentence in the paper. The ladder question — how does this compare to existing work — is where the paper is thinnest. There is no comparison to nonlinear probes, to representation-engineering interventions like RepE, or to methods that explicitly align probe directions post-hoc via Procrustes rotation. The text-only baseline (a classifier that sees only the prompt text, not model internals) is useful but not the strongest possible comparator. The paper demonstrates viability of transfer, not superiority over alternatives. The architecture is deliberately simple: standard linear probes (logistic regression) on residual-stream activations at specific layers. No learned rotation, no fine-tuning of the probe after transfer, no nonlinear heads. This minimalism is the point — the question is whether the cheapest possible classifier survives model updates — but it also means we do not know how much performance a small alignment step (even just re-centering the probe) would recover. The missing experiment is obvious: apply a learned rotation (Procrustes alignment, CCA, or even a cheap affine correction) to the probe after transfer and measure how much of the residual error is recoverable. The authors almost certainly know this is the next step. My read: they are saving it for the follow-up, because the current paper's narrative is cleaner as a 'zero-shot transfer' story. A rotation-corrected probe that closes the gap to 0.00 AUC loss would be a stronger result but a different paper.
